Pass Your CompTIA CAS-005 Exam Easy!

Using DAST in an authorized test environment with representative user flows would not add SAST to pull request checks and route findings to code owners.

Runtime context differs from offline static scanning. The scenario does not present the alternate condition: a production workload needs monitoring that can associate dangerous inputs with executing code paths. The proper immediate action is to add SAST to pull request checks and route findings to code owners.

Running software composition analysis and inspecting reachable use of the component would not add SAST to pull request checks and route findings to code owners.

Requiring verified recovery image and safe maintenance strategy would not verify trusted manufacture and firmware integrity.

The current facts call for this action: verify trusted manufacture and firmware integrity before installation.

Planning a controlled upgrade or isolation with explicit risk acceptance would not verify trusted manufacture and firmware integrity.

The reported condition calls for this action: Use canary rollout with health gates and automatic rollback.

The current facts call for this action: use canary rollout with health gates and automatic rollback.

A local fix can affect shared functionality. The scenario does not present the alternate condition: a patch fixes a login bug but breaks a separate mobile authentication flow. The proper immediate action is to use canary rollout with health gates and automatic rollback.

The current facts call for this action: add explicit tenant isolation and authorization acceptance criteria.

Unmeasurable security objectives cannot be validated. The scenario does not present the alternate condition: a product says it must be secure but gives no measurable availability goal. The proper immediate action is to add explicit tenant isolation and authorization acceptance criteria.

The reported condition calls for this action: Add explicit tenant isolation and authorization acceptance criteria.

Generating and retaining an accurate SBOM for each released artifact would not address the need for pin signed dependencies and enforce reviewed source provenance.

A signature alone cannot explain which workflow produced code. The scenario does not present the alternate condition: a signed artifact uses a legitimate vendor certificate but comes from an unauthorized build job. The proper immediate action is to pin signed dependencies and enforce reviewed source provenance.

Requiring contractually useful provenance and dependency transparency would not address the need for pin signed dependencies and enforce reviewed source provenance.

Using immutable signed artifacts and provenance attestations would not meet the need for controlled emergency approval and preserve branch protections and logs.

The current facts call for this action: use controlled emergency approval and preserve branch protections and logs.

Moving essential security gates would not meet the need for controlled emergency approval and preserve branch protections and logs.

The reported condition calls for this action: Record the concern with acceptance authority and a concrete remediation decision.

The current facts call for this action: record the concern with acceptance authority and a concrete remediation decision.

Proof-based analysis can catch unreachable test combinations. The scenario does not present the alternate condition: a safety-critical policy engine has logic paths that ordinary test cases rarely exercise. The proper immediate action is to record the concern with acceptance authority and a concrete remediation decision.

The current facts call for this action: use isolated short-lived identities and secrets scoped to each pipeline stage.

Preventive checks should execute before exposure. The scenario does not present the alternate condition: a code scanning job runs after artifacts are publicly deployed. The proper immediate action is to use isolated short-lived identities and secrets scoped to each pipeline stage.

The reported condition calls for this action: Use isolated short-lived identities and secrets scoped to each pipeline stage.

Verifying trusted manufacture and firmware integrity would not plan a controlled upgrade or isolation with explicit risk acceptance.

Assurance is version-specific. The scenario does not present the alternate condition: a product certification covers a hardware revision different from the delivered version. The proper immediate action is to plan a controlled upgrade or isolation with explicit risk acceptance.

Requiring verified recovery image and safe maintenance strategy would not plan a controlled upgrade or isolation with explicit risk acceptance.

Designing and testing state-compatible rollback or forward recovery would not run regression and integration tests across supported clients.

The current facts call for this action: run regression and integration tests across supported clients.

Using canary rollout with health gates and automatic rollback would not run regression and integration tests across supported clients.

The reported condition calls for this action: Generate and retain an accurate SBOM for each released artifact.

The current facts call for this action: generate and retain an accurate SBOM for each released artifact.

Reproducible inputs reduce supply-chain substitution risk. The scenario does not present the alternate condition: a software release is built from unpinned external packages that can change without review. The proper immediate action is to generate and retain an accurate SBOM for each released artifact.